feat: let consuming apps configure the login features (2FA / passkey / registration)

[andregoepel]

Surfaces marten-identity's new registration / two-factor / passkey feature flags to AppFoundation host apps.

What

• AppFoundationOptions.ConfigureIdentity — a passthrough Action<MartenIdentityBlazorOptions> forwarded to AddMartenIdentityBlazor. A consuming app toggles the login features (and any other identity UI option) from AddAppFoundation:

  builder.AddAppFoundation(o => o.ConfigureIdentity = i =>
  {
      i.EnableUserRegistration = false;
      i.EnablePasskey = false;
  });

• Enforcement: UseAppFoundation now wires UseMartenIdentityFeatureGate(), so a disabled feature's pages and endpoints return 404 / redirect — unreachable by direct URL, not merely hidden.

• Shell UI: the management NavMenu hides the Two-factor authentication and Passkeys entries when those features are disabled (registration has no app-foundation menu entry — the identity Login page owns that link).

Defaults are unchanged: all three features remain enabled unless a host opts out.

Dependency

Bumps AndreGoepel.Marten.Identity.Blazor to 1.2.0-preview1, which introduces the feature-flag API (MartenIdentityBlazorOptions.Enable*, IIdentityFeatureProvider, UseMartenIdentityFeatureGate). Continues @andregoepel's in-progress version bump on main.

⚠️ This pins a preview package. app-foundation shouldn't cut a stable release until marten-identity 1.2.0 final is published and this is bumped off the preview.

Tests

AddAppFoundationIdentityTests: ConfigureIdentity flows through to the resolved MartenIdentityBlazorOptions; without it, the full feature set stays enabled.

Verification

• dotnet restore --locked-mode — clean (lock files updated to 1.2.0-preview1).
• dotnet build -c Release — 0 errors; dotnet test -c Release — 82/82.
• csharpier check passes on the changed C# files.

Note for the host (andregoepel.dev)

A host that wants a persistent, admin-editable toggle (rather than config-time) can register its own IIdentityFeatureProvider — the default OptionsIdentityFeatureProvider is TryAdd-registered, so a host implementation takes precedence.

[andregoepel]

Extended this PR to make the flags admin-editable at runtime (persisted), not just config-time:

• IdentityFeatureSettingsDocument (Marten) + IIdentityFeatureSettingsStore persist the flags; MartenIdentityFeatureProvider replaces the identity package's options-only IIdentityFeatureProvider (registered after AddMartenIdentityBlazor, last-wins), so the feature gate and nav menu honour saved values — falling back to the ConfigureIdentity baseline until an admin saves.
• New Administration → Login Features page (/Administration/LoginFeatures, Administrator-only) with a switch per feature + a "configuration baseline" hint until first save.
• AddAppFoundationIdentityFeatures() wires it from AddAppFoundation.

So the model is: ConfigureIdentity sets the baseline; the admin page overrides it at runtime with no redeploy. Same precedence contract the identity package documents (a registered IIdentityFeatureProvider beats the options default).

Tests: bUnit page test (load/save/route/authorize) + provider mapping test. 87/87 passing, locked restore + csharpier clean.